isascii
The function is useful in scenarios where you want to detect non-ASCII text in logs, validate inputs for encoding compliance, or identify potential anomalies introduced by copy-pasted foreign characters or malformed input in user-submitted data.
Usage#
Syntax#
isascii(value)Parameters#
| Name | Type | Description |
|---|---|---|
| value | string | The input string to check for ASCII content |
Returns#
A bool value:
trueif all characters invalueare ASCII characters.falseif any character is outside the ASCII range.
Use case examples#
Identify non-ASCII characters in request URIs to detect unusual or malformed traffic.
Query
['sample-http-logs']
| extend is_ascii_uri = isascii(uri)
| summarize count() by is_ascii_uriOutput
| is_ascii_uri | count_ |
|---|---|
| true | 14250 |
| false | 130 |
This query flags requests with non-ASCII characters in the uri field. These entries can indicate abnormal requests or encoding issues in log data.
Detect non-ASCII span IDs, which could indicate instrumentation bugs or encoding anomalies.
Query
['otel-demo-traces']
| extend is_ascii_span_id = isascii(span_id)
| summarize count() by is_ascii_span_idOutput
| is_ascii_span_id | count_ |
|---|---|
| true | 28700 |
| false | 2 |
This query validates that span IDs in your telemetry traces contain only ASCII characters. Non-ASCII values may hint at bugs or corrupted trace headers.
Identify requests where user IDs contain non-ASCII characters, which can help detect suspicious or malformed entries.
Query
['sample-http-logs']
| extend is_ascii_id = isascii(id)
| summarize count() by is_ascii_idOutput
| is_ascii_id | count |
|---|---|
| true | 11900 |
| false | 350 |
This query detects potentially malicious or malformed user IDs by filtering for non-ASCII values in the id field.
Other query languages#
Splunk SPL users
Splunk SPL doesn’t have a direct equivalent to isascii. To achieve similar functionality, you typically need to use match() or custom regular expressions. In contrast, APL provides isascii as a simple built-in function, making the check much more concise and performant.
Splunk example
... | eval is_ascii=if(match(field, "^[\x00-\x7F]+$"), "true", "false")APL equivalent
datatable(input:string)
[
'hello',
'こんにちは'
]
| extend is_ascii = isascii(input)ANSI SQL users
ANSI SQL doesn’t provide a built-in isascii function. You often need to simulate it using regular expressions or character code checks. APL simplifies this with the dedicated isascii function.
SQL example
SELECT input,
CASE WHEN input ~ '^[\x00-\x7F]+$' THEN true ELSE false END AS is_ascii
FROM my_table;APL equivalent
datatable(input:string)
[
'hello',
'こんにちは'
]
| extend is_ascii = isascii(input)